- Added new debug commands (portmap, derp, capture), a configure helper, and overhauled serve with Funnel as a separate command; tailnet lock now works with preauth keys.
- Improved platform support: broader UPnP port‑mapping, Linux certs in K8s secrets, Windows MSI launches GUI silently, macOS node‑key expiration notification and SSH server, iOS alternate control server URL, Android Chromecast fix.
- Documentation update: early‑warning notice that Windows 7/8, Server 2008/2012 and macOS 10.13/10.14 will lose support; macOS 10.15+ required.